Description
Apache Struts 2.0.0 至 6.4.0之前的版本中的文件上传逻辑存在缺陷。攻击者可以通过操纵文件上传参数实现路径遍历，并在某些情况下上传恶意文件，从而执行远程代码。
Apache Struts s-067 存在任意文件上传漏洞（CVE-2024-53677）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-53677
https://cwiki.apache.org/confluence/display/WW/S2-067
https://nsfocusglobal.com/apache-struts-arbitrary-file-upload-vulnerability-s2-067-cve-2024-53677/
https://blog.nsfocus.net/apache-strutss2-067cve-2024-53677/
https://www.acunetix.com/vulnerabilities/web/apache-struts-path-traversal-s2-067-cve-2024-53677-s2-066-cve-2023-50164/
https://censys.com/advisory/cve-2024-53677/
https://www.sonicwall.com/blog/apache-struts-path-traversal-to-rce-cve-2024-53677
https://github.com/TAM-K592/CVE-2024-53677-S2-067
https://blog.qualys.com/vulnerabilities-threat-research/2024/12/16/critical-apache-struts-file-upload-vulnerability-cve-2024-53677-risks-implications-and-enterprise-countermeasures
https://www.tenable.com/plugins/was/114549